Splunk Search

How do you use regex on 2 fields and combine them into one field for an xyseries?

krusovice
Path Finder

Hi all,

I have a simple regex to extract 2 fields — name1 and name2. And I would need to combine it like this: name1.name2 and send it to xyseries as one name. I can't make it work with the below query.

| rex "line1\=(?<name1>[\w+]+)" 
| rex "line2\=(?<name2>[\w+]+)"
| eval fullname=name1.name2
| xyseries fullname date_hour count

Could someone please help me? Thank you in advance.

Tags (1)
1 Solution

bjoernjensen
Contributor

Hey,

most probably you have some NULL values. Use fillnull with an appropriate value (could also be NULL not an empty string as below):

| rex "line1\=(?<name1>[\w+]+)" 
| rex "line2\=(?<name2>[\w+]+)"
| fillnull name1 value=""
| fillnull name2 value=""
| eval fullname=name1.".".name2
| xyseries fullname date_hour count

Additionally this will actually add a dot . between name1 and name2

If that is not working... please provide the result without the last xyseries ...

Hope that helps,
Björn

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Is there a reason for using xyseries with date_hour instead of timechart span=1h?
The date_foo fields are often trouble.

0 Karma

bjoernjensen
Contributor

Hey,

most probably you have some NULL values. Use fillnull with an appropriate value (could also be NULL not an empty string as below):

| rex "line1\=(?<name1>[\w+]+)" 
| rex "line2\=(?<name2>[\w+]+)"
| fillnull name1 value=""
| fillnull name2 value=""
| eval fullname=name1.".".name2
| xyseries fullname date_hour count

Additionally this will actually add a dot . between name1 and name2

If that is not working... please provide the result without the last xyseries ...

Hope that helps,
Björn

0 Karma

krusovice
Path Finder

Thank you, you have given some clue how to fix my SPL. Thank you.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@krusovice

Can you please share you sample events?

0 Karma

krusovice
Path Finder

raw data like this:

line1=aaa
line2=yyy

Expected fullname should be aaa.yyy in x-axis of the table.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@krusovice

As per you given event, name1 and name2 are in separate event. So you have to make it in single event by aggregating. like using stats values

| stats values(name1) as name1 values(name2) as name2 by date_hour

here if you have any unique id for both events then you have to use it in by clause.

| stats values(name1) as name1 values(name2) as name2 by <<UNIQUE_ID>>

For reference see below search.

| makeresults 
| eval _raw="line1=aaa" 
| append 
    [| makeresults 
    | eval _raw="line2=yyy"] | eval ID=10 | eval date_hour=10
| rex "line1=(?<name1>[\w+]+)" 
| rex "line2=(?<name2>[\w+]+)"  
| stats values(name1) as name1 values(name2) as name2 count by ID date_hour
| eval fullname=name1.".".name2
| xyseries fullname date_hour count

Thanks

0 Karma

prakash007
Builder

How about this..

| rex "line1\=(?<name1>[\w+]+)" 
| rex "line2\=(?<name2>[\w+]+)"
| eval fullname=name1." ".name2
| xyseries fullname date_hour count

krusovice
Path Finder

Hi @prakash007,

Thanks for reply, it is not working.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...